Snort mailing list archives
RE: oinkmaster - disabling rules without getting new updates
From: "Humes, David G." <David.Humes () jhuapl edu>
Date: Mon, 19 Sep 2005 17:35:58 -0400
Yes, that could work and we are using suppression for some rules. But, if it's really firing hard and it's clearly a false positive, it would be better not to waste cpu power on the rule. -----Original Message----- From: Joel Esler [mailto:joel.esler () sourcefire com] Sent: Monday, September 19, 2005 5:17 PM To: Humes, David G. Cc: snort-users () lists sourceforge net; oinkmaster-users () lists sourceforge net Subject: Re: [Snort-users] oinkmaster - disabling rules without getting new updates My suggestion would be to look into suppression. That way you're not turning off a rule completely, and you're able to specifically tune the suppression towards your environment. Joel Esler SOURCEfire On Sep 19, 2005, at 5:12 PM, Humes, David G. wrote: I just setup oinkmaster to update our rules. Let's say that a rule suddenly starts generating thousands of false positive alerts, and we want to disable the rule. Normally I would add a disablesid line to the conf file and run oinkmaster. But, that's going to update my rules with the latest rule set, which may or may not be what I want. If it's late on a Friday afternoon, I don't want to introduce new rules that may false positive over the weekend. The oinkmaster documentation is fairly insistent about not editing the rules files directly. But, one approach is to edit the appropriate rules file and restart snort, and also edit the oinkmaster.conf file to make certain the rule does not get re-enabled. Another possibility is to run oinkmaster using only local copies of the rules archives so it doesn't update from the URLs. But, that introduces an extra step of having to manually download the updates. Yet another approach would be to run oinkmaster interactively, and just reject all the changes with the exception of the one I added. Ideally, I think that there should be an oinkmaster option for this to minimize extra steps and to keep people from editing the rules files directly. Thoughts? Thanks. --Dave
Current thread:
- oinkmaster - disabling rules without getting new updates Humes, David G. (Sep 19)
- Re: oinkmaster - disabling rules without getting new updates Joel Esler (Sep 19)
- Re: oinkmaster - disabling rules without getting new updates Andreas Östling (Sep 20)
- Re: oinkmaster - disabling rules without getting new updates Alex Butcher, ISC/ISYS (Sep 20)
- <Possible follow-ups>
- RE: oinkmaster - disabling rules without getting new updates Humes, David G. (Sep 19)